You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
dotfiles/install.sh

447 lines
14 KiB

#!/usr/bin/env bash
set -uo pipefail
trap 's=$?; echo "$0: Error on line "$LINENO": $BASH_COMMAND"; exit $s' ERR
PRESERVE_ENV=AUR_PAGER,PACKAGER,EDITOR
if [[ $EUID != 0 ]]; then
echo 'Elevating privileges'
exec sudo --preserve-env="${PRESERVE_ENV}" "$0" "$@"
fi
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
# Initialize AUR repo
if [[ ! -d /var/cache/pacman/aur ]]; then
install -m755 -d /var/cache/pacman/aur
repo-add /var/cache/pacman/aur/aur.db.tar.zst
fi
# Configure pacman
install -pm644 "$DIR/etc/pacman/pacman.conf" /etc/pacman.conf
install -pm644 -Dt /etc/pacman.d/conf.d \
"$DIR/etc/pacman/00-global-options.conf" \
"$DIR/etc/pacman/50-core-repositories.conf" \
"$DIR/etc/pacman/55-multilib-repository.conf" \
"$DIR/etc/pacman/60-aurutils-repository.conf" \
"$DIR/etc/pacman/99-options.conf"
# Remove packages no longer in use
to_remove=()
for pkg in "${to_remove[@]}"; do
pacman --noconfirm -Rs "$pkg" || true
done
packages=(
# Basic packages & system tools
base
dracut # Build initrd & unified EFI images
linux-firmware
intel-ucode
linux
lsb-release
sudo
zram-generator # swap on compressed RAM, mostly to support systemd-oomd
sbctl # Manage secure boot binaries and sign binaries
# File systems
ntfs-3g
exfatprogs
btrfs-progs
# Hardware tools
fwupd # Firmware updates
usbutils # for lsusb
# System monitoring
htop
lsof
# Power management
powertop
power-profiles-daemon
# Networking
networkmanager
firewalld
# DNS-SD, mostly for printers, i.e. CUPS. Service discovery is handled by Avahi,
# name resolution by systemd-resolved.
avahi
# Arch tools & infrastructure
pacman-contrib # paccache, checkupdates, pacsearch, and others
reflector # Weekly mirrorlist updates
kernel-modules-hook # Keep kernel modules on kernel updates
pkgfile
# Build packages
base-devel
namcap
aurpublish # Publish AUR packages from Git subtrees
# Dotfiles manager
chezmoi
# Terminal, shell & tools
man-db
man-pages
bash-completion
code
neovim
exa # Better ls (with git support)
nnn # Command line file manager (also a good pager for aurutils)
rsync
curl
p7zip
zip
# Document processing and rendering
pandoc
mdcat
asciidoctor
zathura # Lightweight document viewer
# Spellchecking
hunspell
hunspell-de
hunspell-en_gb
hunspell-en_us
# Git and related tools
git
git-filter-repo
tea # CLI for gitea servers
tig # Curses git interfaces
# Bash tools
shellcheck
shfmt
# Other development tools
jq # Process JSON on command line
# Desktop tools
wl-clipboard
dconf-editor
# Desktop services
xdg-user-dirs
xdg-utils
xdg-desktop-portal
pcsclite # Smartcard daemon, for e-ID
libfido2
cups
bluez
sane
pipewire-pulse # Pipewire-based pulse-audio, replaces pulseaudio
wireplumber # Recommended pipewire session & policy manager
firefox # Browser
firefox-i18n-de
firefox-dark-reader
firefox-ublock-origin
vlc # Video player
pipewire-jack # required by vlc
inkscape # Vector graphics
gimp # Pixel graphics
libreoffice-fresh
libreoffice-fresh-de
lollypop # Music player
#xournalpp # Handwriting tool
#signal-desktop # Secure mobile messenger
# Fonts & themes
# Fallback font with huge coverage and colored emojis
noto-fonts
noto-fonts-extra
noto-fonts-cjk
noto-fonts-emoji
# Microsoft compatibility fonts
ttf-liberation
ttf-caladea
ttf-carlito
ttf-cascadia-code
# Gnome
gdm
gnome-characters
gnome-keyring
gnome-screenshot
gnome-maps
gnome-clocks
gnome-weather
gnome-calendar
gnome-terminal
gnome-shell
gnome-shell-extensions
gnome-shell-extension-appindicator
gnome-remote-desktop
gnome-system-monitor
gnome-control-center
gnome-tweaks
gnome-calculator
gnome-backgrounds
gnome-themes-extra # For adwaita-dark
xdg-desktop-portal-gnome # Desktop portals
xdg-user-dirs-gtk
evolution
file-roller
yelp # Online help system
nautilus
python-nautilus
gvfs-afc
gvfs-goa
gvfs-gphoto2
gvfs-mtp
gvfs-nfs
gvfs-smb
sushi # Previewer for nautilus
evince # Document viewer
eog # Image viewer
simple-scan
seahorse # Credential manager
baobab # Disk space analyser
# Multimedia for gnome
gst-plugins-good
gst-plugins-bad
gst-plugins-ugly
)
optdeps=(
# pipewire
pipewire-pulse wireplumber
# linux: wireless frequency policies (provided as crda)
wireless-regdb
# pipewire: zeroconf support
pipewire-zeroconf
# poppler: data files
poppler-data
# dracut:
binutils # --uefi
elfutils # stripping
sbsigntools # efi signing
tpm2-tools # tpm2-tss
# zathura: PDF support
zathura-pdf-mupdf
# libva: intel drivers
intel-media-driver
# gnome-shell-extension-appindicator: GTK3 apps
libappindicator-gtk3
# aurutils: chroot support
devtools
# zim: spell checking
gtkspell3
# inkscape: optimized SVGs
scour
# kiconthemes: Additional icons for KDE apps
#breeze-icons
)
pacman -Syu --noconfirm --needed "${packages[@]}"
pacman -S --noconfirm --needed --asdeps "${optdeps[@]}"
pacman -D --noconfirm --asdeps "${optdeps[@]}"
# Currently dracut is missing an optdepends on tpm2-tools, see
# https://bugs.archlinux.org/task/73229
pacman -D --asexplicit tpm2-tools
services=(
# Core system services
systemd-boot-update.service # Update boot loader automatically
systemd-homed.service # homed for user management and home areas
systemd-oomd.service # Userspace OOM killer
systemd-timesyncd.service # Time sync
systemd-resolved.service # DNS resolution
# Other system services
firewalld.service # Firewall
# Timers
fstrim.timer # Periodically trim file systems…
"btrfs-scrub@$(systemd-escape -p /).timer" # scrub root filesystem…
paccache.timer # clean pacman cache…
pkgfile-update.timer # update pkgfile list…
fwupd-refresh.timer # check for firmware updates…
reflector.timer # and update the mirrorlist.
# Desktop services
gdm.service # Desktop manager
power-profiles-daemon.service # Power profile management
NetworkManager.service # Network manager for desktops
avahi-daemon.service # Local network service discovery (for WLAN printers)
cups.service # Printing
bluetooth.service # Bluetooth
pcscd.socket # Smartcards, mostly eID
)
if [[ -n "${SUDO_USER:-}" ]]; then
# Scrub home directory of my user account
services+=("btrfs-scrub@$(systemd-escape -p "/home/${SUDO_USER}").timer")
fi
systemctl enable "${services[@]}"
# See /usr/share/factory/etc/nsswitch.conf for the Arch Linux factory defaults.
# We add mdns hostnames (from Avahi) and libvirtd names, and also shuffle things around
# to follow the recommendations in nss-resolve(8) which Arch Linux deliberately doesn't
# do by default, see e.g. https://bugs.archlinux.org/task/57852
NSS_HOSTS=(
# Resolves containers managed by systemd-machined
mymachines
# Resolve everything else with systemd-resolved and bail out if resolved
# doesn't find hostname. Everything after this stanza is just fallback in
# case resolved is down
resolve '[!UNAVAIL=return]'
# Resolve hosts from /etc/hosts (systemd-resolved handles /etc/hosts as well
# so this comes after resolve)
files
# Resolves gethostname(), i.e. /etc/hostname
myhostname
# Resolves from DNS
dns
)
sed -i '/^hosts: /s/^hosts: .*/'"hosts: ${NSS_HOSTS[*]}/" /etc/nsswitch.conf
# Bootloader and initrd configuration
install -pm644 "$DIR/etc/dracut.conf" /etc/dracut.conf.d/50-custom.conf
install -pm644 "$DIR/etc/loader.conf" /efi/loader/loader.conf
if [[ -f /usr/share/secureboot/keys/db/db.key ]] && [[ -f /usr/share/secureboot/keys/db/db.pem ]]; then
install -pm644 "$DIR/etc/dracut-sbctl.conf" /etc/dracut.conf.d/90-sbctl-signing.conf
else
rm -f /etc/dracut.conf.d/90-sbctl-signing.conf
fi
# System configuration
install -pm644 "$DIR/etc/faillock.conf" /etc/security/faillock.conf
install -pm644 "$DIR/etc/modprobe.conf" /etc/modprobe.d/modprobe.conf
# sudo configuration
install -dm750 /etc/sudoers.d/
install -pm600 -t/etc/sudoers.d "$DIR"/etc/sudoers.d/*
# Systemd configuration
ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
install -Dpm644 "$DIR/etc/systemd/system.conf" /etc/systemd/system.conf.d/50-custom.conf
install -Dpm644 "$DIR/etc/systemd/timesyncd.conf" /etc/systemd/timesyncd.conf.d/50-custom.conf
install -Dpm644 "$DIR/etc/systemd/resolved.conf" /etc/systemd/resolved.conf.d/50-custom.conf
install -Dpm644 "$DIR/etc/systemd/zram-generator.conf" /etc/systemd/zram-generator.conf
install -Dpm644 "$DIR/etc/systemd/oomd.conf" /etc/systemd/oomd.conf.d/oomd.conf
install -Dpm644 "$DIR/etc/systemd/root-slice-oomd.conf" /etc/systemd/system/-.slice.d/50-oomd.conf
install -Dpm644 "$DIR/etc/systemd/user-service-oomd.conf" /etc/systemd/system/user@.service.d/50-oomd.conf
# Services configuration
install -Dpm644 "$DIR/etc/networkmanager-mdns.conf" /etc/NetworkManager/conf.d/50-mdns.conf
install -Dpm644 "$DIR/etc/reflector.conf" /etc/xdg/reflector/reflector.conf
install -Dpm644 "$DIR/etc/bluetooth.conf" /etc/bluetooth/main.conf
install -Dpm644 "$DIR/etc/snapper-root.conf" /etc/snapper/configs/root
# Global font configuration
for file in 10-hinting-slight 10-sub-pixel-rgb 11-lcdfilter-default; do
ln -sf /usr/share/fontconfig/conf.avail/$file.conf /etc/fonts/conf.d/$file.conf
done
# Locale settings
localectl set-locale de_DE.UTF-8
# --no-convert stops localectl from trying to apply the text console layout to
# X11/Wayland and vice versa
localectl set-keymap --no-convert de
localectl set-x11-keymap --no-convert de pc105
# GDM dconf profile, for global GDM configuration, see
# https://help.gnome.org/admin/system-admin-guide/stable/login-banner.html.en
install -Dpm644 "$DIR/etc/gdm-profile" /etc/dconf/profile/gdm
# Start firewalld and configure it
systemctl start firewalld.service
firewall-cmd --permanent --zone=home \
--add-service=upnp-client \
--add-service=rdp \
--add-service=ssh
# Don't allow incoming SSH connections on public networks (this is a weird default imho)
firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --reload
# Setup secure boot
if command -v sbctl > /dev/null && [[ -f /usr/share/secureboot/keys/db/db.key ]]; then
# Generate signed bootloader image
if ! sbctl list-files | grep -q /usr/lib/systemd/boot/efi/systemd-bootx64.efi; then
sbctl sign -s -o /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed /usr/lib/systemd/boot/efi/systemd-bootx64.efi
bootctl update --graceful
fi
# Generate signed firmware updater
if ! sbctl list-files | grep -q /usr/lib/fwupd/efi/fwupdx64.efi; then
sbctl sign -s -o /usr/lib/fwupd/efi/fwupdx64.efi.signed /usr/lib/fwupd/efi/fwupdx64.efi
fi
sbctl sign-all
sbctl verify # Safety check
fi
# Install or update, and then configure the bootloader.
# Do this AFTER signing the boot loader with sbctl, see above, to make sure we
# install the signed loader.
if ! [[ -e /efi/EFI/BOOT/BOOTX64.EFI ]]; then
bootctl install
else
bootctl update --graceful
fi
# Allow myself to build AUR packages
if [[ -n "${SUDO_USER:-}" && "$(stat -c '%U' /var/cache/pacman/aur)" != "$SUDO_USER" ]]; then
chown -R "$SUDO_USER:$SUDO_USER" /var/cache/pacman/aur
fi
# Bootstrap aurutils
if [[ -n "${SUDO_USER:-}" ]] && ! command -v aur &>/dev/null; then
sudo -u "$SUDO_USER" bash <<'EOF'
set -xeuo pipefail
BDIR="$(mktemp -d --tmpdir aurutils.XXXXXXXX)"
echo "Building in $BDIR"
cd "$BDIR"
git clone --depth=1 "https://aur.archlinux.org/aurutils.git"
cd aurutils
makepkg --noconfirm --nocheck -rsi
EOF
fi
# Configure aurutils
if [[ ! -e "/etc/aurutils/pacman-aur.conf" ]]; then
install -Dpm644 /usr/share/devtools/pacman-extra.conf "/etc/aurutils/pacman-aur.conf"
cat <<EOF >>"/etc/aurutils/pacman-aur.conf"
# aurutils repo
[aur]
SigLevel = Optional TrustAll
Server = file:///var/cache/pacman/aur
EOF
fi
aur chroot --create
aur_packages=(
# AUR helper
aurutils
# Splash screen at boot
plymouth
# Gnome extensions
gnome-shell-extension-nasa-apod
# Dracut hook to build kernel images for systemd boot
dracut-hook-uefi
# Additional fonts
otf-vollkorn # My favorite serif font for documents
ttf-fira-go # A nice font for presentations
# Additional tools
git-gone
# Connect phone and desktop system
gnome-shell-extension-gsconnect
firefox-extension-https-everywhere
)
aur_optdeps=(
# plymouth: truetype fonts
ttf-dejavu cantarell-fonts
)
if [[ -n "${SUDO_USER:-}" ]]; then
# Build AUR packages and install them
if [[ ${#aur_packages} -gt 0 ]]; then
sudo -u "$SUDO_USER" --preserve-env="${PRESERVE_ENV}" \
nice aur sync -daur -cRT "${aur_packages[@]}" "${aur_optdeps[@]}"
pacman --needed -Syu "${aur_packages[@]}"
fi
if [[ ${#aur_optdeps[@]} -gt 0 ]]; then
pacman --needed -S --asdeps "${aur_optdeps[@]}"
pacman -D --asdeps "${aur_optdeps[@]}"
fi
remove_from_repo=()
if [[ ${#remove_from_repo[@]} -gt 0 ]]; then
for pkg in "${remove_from_repo[@]}"; do
rm -f "/var/cache/pacman/aur/${pkg}-"*.pkg.tar.*
done
sudo -u "$SUDO_USER" repo-remove /var/cache/pacman/aur/aur.db.tar.zst "${remove_from_repo[@]}" || true
fi
fi
# Set plymouth theme
if command -v plymouth-set-default-theme > /dev/null; then
plymouth-set-default-theme bgrt
fi